Follow-up from PR #2572: document verify_intent lifecycle change and finish UTC normalization in base.py

[Ricky-G]

Summary

Tracking issue for the remaining review feedback from @qubeena07 on PR #2572 (skill-aware audit trail hardening). These were not blockers for that PR but should be addressed as follow-ups.

Items

1. Document the verify_intent lifecycle narrowing. PR fix(agent-os): harden foundational skill-aware audit trail for issue #1609 #2572 changed verify_intent in agent-governance-python/agent-os/src/agent_os/intent.py to require the EXECUTING state (previously APPROVED was also accepted), so the lifecycle is strictly declare, approve, execute, verify. An explanatory code comment was added (around intent.py:701-703) and the rationale was given in the PR thread, but it was never written into the PR description or CHANGELOG. Capture the intended behavior formally and confirm no caller relied on verifying directly from APPROVED.

2. Finish UTC normalization in base.py. Several naive datetime.now() calls remain in agent-governance-python/agent-os/src/agent_os/integrations/base.py (around lines 1303, 1345, 1432, 1453). For consistency with the UTC normalization done in the adapters, switch these to datetime.now(timezone.utc).

3. Optional: make provenance_source_trust an enum. It is currently tightened to Literal["trusted"]. If more granular trust levels are ever needed, promote it to an Enum so comparisons stay consistent across consumers.

References

• PR: fix(agent-os): harden foundational skill-aware audit trail for issue #1609 #2572
• RFC: RFC: Govern agent Skills (context injection) across ADK, CrewAI, Semantic Kernel, and OpenAI Agents SDK #1609
• Unresolved review thread: intent.py:703 (verify_intent guard)

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	NONE
Overall	MEDIUM

Automated check by AGT Contributor Check.